binary-husky/gpt_academic · error · FriendlyException

输入文件的路径 ({path_or_url}) 存在，但属于其他用户。请将文件上传后再执行该任务。

Error message

输入文件的路径 ({path_or_url}) 存在，但属于其他用户。请将文件上传后再执行该任务。

What it means

Second stage of the same path guard: when the path IS under PATH_LOGGING or PATH_PRIVATE_UPLOAD, the first path segment must name the requesting user or one of the service users ('autogen', 'arxiv_cache', default_user_name). A path under another user's directory raises FriendlyException — this is per-user isolation preventing cross-user file access on a shared server.

Source

Thrown at shared_utils/fastapi_server.py:69

    from toolbox import get_conf, default_user_name
    from toolbox import FriendlyException
    PATH_PRIVATE_UPLOAD, PATH_LOGGING = get_conf('PATH_PRIVATE_UPLOAD', 'PATH_LOGGING')
    sensitive_path = None
    path_or_url = os.path.relpath(path_or_url)
    if path_or_url.startswith(PATH_LOGGING):    # 日志文件（按用户划分）
        sensitive_path = PATH_LOGGING
    elif path_or_url.startswith(PATH_PRIVATE_UPLOAD):   # 用户的上传目录（按用户划分）
        sensitive_path = PATH_PRIVATE_UPLOAD
    elif path_or_url.startswith('tests') or path_or_url.startswith('build'):   # 一个常用的测试目录
        return True
    else:
        raise FriendlyException(f"输入文件的路径 ({path_or_url}) 存在，但位置非法。请将文件上传后再执行该任务。") # return False
    if sensitive_path:
        allowed_users = [user, 'autogen', 'arxiv_cache', default_user_name]  # three user path that can be accessed
        for user_allowed in allowed_users:
            if f"{os.sep}".join(path_or_url.split(os.sep)[:2]) == os.path.join(sensitive_path, user_allowed):
                return True
        raise FriendlyException(f"输入文件的路径 ({path_or_url}) 存在，但属于其他用户。请将文件上传后再执行该任务。") # return False
    return True

def _authorize_user(path_or_url, request, gradio_app):
    from toolbox import get_conf, default_user_name
    PATH_PRIVATE_UPLOAD, PATH_LOGGING = get_conf('PATH_PRIVATE_UPLOAD', 'PATH_LOGGING')
    sensitive_path = None
    path_or_url = os.path.relpath(path_or_url)
    if path_or_url.startswith(PATH_LOGGING):
        sensitive_path = PATH_LOGGING
    if path_or_url.startswith(PATH_PRIVATE_UPLOAD):
        sensitive_path = PATH_PRIVATE_UPLOAD
    if sensitive_path:
        token = request.cookies.get("access-token") or request.cookies.get("access-token-unsecure")
        user = gradio_app.tokens.get(token)  # get user
        allowed_users = [user, 'autogen', 'arxiv_cache', default_user_name]  # three user path that can be accessed
        for user_allowed in allowed_users:
            # exact match
            if f"{os.sep}".join(path_or_url.split(os.sep)[:2]) == os.path.join(sensitive_path, user_allowed):

View on GitHub (pinned to d6bde0fa54)

Solutions

1. Upload the file yourself so it lands under your own user directory, then use the returned path.
2. If legitimate sharing is needed, place files under the default_user_name or arxiv_cache subtree that is allow-listed.
3. Check that the username sent with the request matches the directory owner prefix.

import os

def path_belongs_to_allowed_user(p: str, sensitive_root: str, user: str,
                                 allowed=('autogen', 'arxiv_cache', default_user_name)) -> bool:
    first_two = os.sep.join(os.path.relpath(p).split(os.sep)[:2])
    return any(first_two == os.path.join(sensitive_root, u)
               for u in {user, *allowed})

if not path_belongs_to_allowed_user(f, sensitive_path, current_user):
    f = reupload_to_own_directory(f)

try:
    run_api_task(input_file=...)
except FriendlyException as e:
    if '属于其他用户' in str(e):
        f = upload_file_first(local_copy)  # get a path under your own user dir
        run_api_task(input_file=f)

When it happens

Trigger: User A sends a request referencing private_upload/<userB>/file.pdf or logging/<userB>/... while authenticated/identified as user A; the join of the first two path segments doesn't match sensitive_path + any allowed user.

Common situations: Copy-pasting another user's file path; multi-user deployments where clients hardcode a shared path; stale paths from a previous user identity after re-login.

Related errors

• 输入文件的路径 ({path_or_url}) 存在，但位置非法。请将文件上传后再执行该任务。
• Attempted Symlink in {member.name}
• Attempted Path Traversal in {member.name}

AI-assisted analysis of binary-husky/gpt_academic@d6bde0fa54 (2026-08-14). Data as JSON: /api/errors/44899ac77970b3c5. Report an issue: GitHub.